Method For Identifying Undesired Telephone Calls

ABSTRACT

A method for identifying undesired telephone calls (Spit/Spam over IP), preferably in a VoIP network, in which the telephone calls coming in for a telephone subscriber, the callee, from at least one calling telephone subscriber, the caller, are subjected to a test or more precisely to a statistical analysis. The method is developed in such a manner that in the framework of the test for incoming calls, the time of the receipt of each call is determined and in each case the probability that the call is undesired is determined, where for the calculation of the probability the time of the receipt of the call, or a parameter dependent thereon, is related to the temporal distribution of previous undesired calls.

The invention relates to a method for identifying undesired telephonecalls, preferably in a VoIP network, in which the telephone calls comingin for a telephone subscriber, the callee, from at least one callingtelephone subscriber, the caller, are subjected to a test.

In the field of electronic mail undesired mass e-mails, so-called spam,are very prevalent and have developed into a massive problem. Not onlycompanies which are dependent on e-mail communication are affected byspam messages, but rather, also in the private sector, spam has provenitself to be extremely annoying. Many Internet users receive on averagemore spam messages than ordinary e-mails. Thus, in almost every e-mailinput server, spam filters are used with which incoming e-mails arechecked according to definite rules. Therein, for example, the contentof the e-mails is actively searched for keywords, checked for certainconfigurations of the server which was used to send the e-mail, or issearched for senders which are frequently used to send mass e-mails. Ifan e-mail is classified as spam, it is marked and/or sorted out.

In the field of telephony, analog or digital, spam is likewise occurringmore heavily, which expresses itself there in the form of undesiredtelephone calls, e.g., in the form of advertising calls. Usually, thesecalls are made by automated calling machines. In the public switchedtelephone networks (PSTN) still standardly used, spam calls of this typeare extremely complicated and expensive so that the number of spam callsin said networks is kept within limits. Against the background of therapid development of Internet telephony, also known as Voice over IP(VoIP), however, a massive increase of spam calls must be assumed sincethey are significantly simpler and more economical to realize incomparison to public switched telephone networks. In the framework ofInternet telephony undesired calls of this type are also called SPIT(SPam over Internet Telephony). In accordance with the developmentpointed out, processes for blocking SPIT are increasingly gaining ininterest and in the future will probably reach an importance comparableto those processes which today are used for blocking e-mail Spam.

The processes used in e-mail spam filters cannot, however, betransferred to telephony, or can only be transferred in part and in avery restricted manner. Thus, for example, the complete content of ane-mail is examined by a spam filter before the message is passed on tothe recipient. A procedure of this type is not possible in the case oftelephone conversations since the content of a telephone conversationonly becomes known in the course of the conversation.

Available technologies for identifying and in given cases blocking SPITare based essentially on white and black lists and on the filtering ofcontents. For filtering contents in speech communications differenttypes of Turing tests are carried out with which it is attempted to findout whether the caller is a human being or a machine. Other processeswhich have been proposed recently take into account social networksbetween users using buddy lists. An additional technology which at themoment is being standardized by the IETF is directed more towardprotecting the identity of the caller as a prerequisite for ensuringsecure communication.

In the known processes it is consistently disadvantageous that foridentifying undesired SPIT calls parameters are resorted to which can befalsified more or less easily with malicious intent on the part of thecaller. Thus, a caller can easily change her/his identity, e.g., in theform of an IP address, and in this way circumvent an implemented filtermechanism. Moreover, several of the known processes are extremelyinflexible in the sense that it is hardly possible to react rapidly andcorrectly to possible changes in the behavior of a caller generatingSPIT calls.

The present invention is based on the objective of developing andextending a method of the type stated in the introduction in such amanner that, with simple means, identification of undesired telephonecalls which is, to the greatest possible extent, independent of thesystem is enabled and that, in comparison to known methods,circumvention is made more difficult for a caller placing the undesiredcalls.

The method according to the invention realizes the above objectivethrough the features of claim 1. According thereto, the generic processis extended in such a manner that in the framework of the test forincoming calls, the time of the receipt of each call is determined andin each case the probability that the call is undesired is determined,where for the calculation of the probability the time of the receipt ofthe call, or a parameter dependent thereon, is related to the temporaldistribution of previous undesired calls.

In the manner according to the invention it has first been recognizedthat undesired telephone calls, in particular calls generated by callingmachines, can be dealt with, even without knowledge of the caller'sidentity, the contents of the telephone conversation, or other specificinformation, in a simple manner, namely on the basis of how the call tobe investigated behaves from purely temporal points of view with respectto a pattern of the temporal distribution of previous undesired calls.For this, according to the invention, for each incoming call the time ofthe receipt of the call is determined. This time is related to thetemporal distribution of previous undesired calls and from thisrelationship a probability that the call is undesired is derived. Themore precisely the time of the receipt of the call fits into thetemporal distribution of the previous undesired calls, the higher theprobability is that the call is undesired.

Since undesired calls are identified exclusively on the basis of theirtemporal structure, the method proposed according to the invention isparticularly reliable since, in contrast, for example, to the ID of thecaller, it is nearly impossible to falsify or change the temporalparameters with malicious intent. Accordingly, circumvention of theprocess is ruled out to the greatest possible extent.

Moreover, the method according to the invention is independent of theprotocol used for the signaling of the calls. Thus, the method can beused with the protocol H.323, with SIP (Session Initiation Protocol),but also with protocols which will come into use in the future.Moreover, the method according to the invention requires no specificdevice as host.

The invention uses the fact that the callers generating the undesiredtelephone calls are typically machines which are programmed to placecalls with which, for example, advertising content is intended to bedisseminated to a great number of users, i.e., called parties. In sodoing, it is very probable that the callers generating the undesiredcalls, in the following designated as SPITers, are attempting to placeas many calls as possible in a limited time window. It is consequentlyto be assumed that calls are programmed in advance and are placedaccording to certain rules. According to one possible rule a new callcould, for example, be started after a certain interval of time after aprevious call was ended. In so doing, the interval of time can either beconstant or follow a given distribution. The interval of time betweenthe respective arrivals of sequential calls can also be constant orfollow a certain, given distribution. This distribution of calls isdesignated in the following as “short-term behavior.”

Moreover, a structured “long-term behavior” according to which a SPITer,following certain rules, starts entire bundles of SPIT calls is also notimprobable. A rule for placing such bundles of SPIT calls can, forexample, specify every day at 8:00 A.M., every workday at 9:00 P.M., onweekends at 12:00 noon, or something similar. The method according tothe invention uses only the described temporal structures in order toidentify undesired telephone calls.

In the framework of an advantageous development the tests are carriedout in an operating phase, where a learning phase precedes the operatingphase in time. Due to the statistical nature of the method it isadvantageous to first investigate a sufficiently large number of calls.For this, a statistical profile of the temporal structure of undesiredcalls is developed over a predefinable period of time. In other words,in the learning phase a history of SPIT calls is developed, where thefocus lies on the temporal distribution of these calls. In aparticularly advantageous manner as many calls as possible within themonitored network are included in the investigation. Accordingly, theinvestigation should not be restricted only to the calls coming in for asingle callee but rather, if possible, should include all the callswithin the network.

In an advantageous manner undesired calls are identified in the learningphase with the aid of predefinable parameters. For example, otherprocesses for the recognition of undesired calls, said processes workingindependently of the method according to the invention, can be used foridentification. In particular, if such external systems are notavailable, feedback from each callee can be used as an aid inidentifying undesired calls. Thus, for example, all the calls which fallbelow a predefinable short length and were ended by the callee can beidentified as undesired calls. A procedure of this type presents itselfsince SPIT victims typically terminate the call as soon as they noticethat it is a SPIT call, e.g., in the form of a machine-generatedadvertising call. The threshold for the length of the call below which acall is to be considered as an undesired call is a freely configurableparameter and can be chosen as a function of the specific environment.Alternatively or additionally, all the calls in which the calleeexplicitly issues a report that it was a SPIT call, can be identified asundesired calls. The report can, for example, be made in the form of anactuation of a special SPIT key or by pressing a special combination ofkeys.

According to an additional alternative, undesired calls can also beidentified in the learning phase by means of other processes forrecognizing undesired calls. Here, for example, the processes named inthe introduction to the description, white and black lists, Turingtests, and so on, present themselves. Let it be emphasized that todevelop a temporal history of undesired calls all the stated methods canalso obviously be combined with one another.

In a particularly advantageous manner the statistical profile of thetemporal structure of undesired calls is also constantly updated in theactual operating phase. In other words, the learning phase is not onlyplaced ahead of the operating phase in time but rather continues duringthe entire operating phase, continuously if possible.

In the framework of the development of the statistical profile of thetemporal structure of the undesired calls coming in for the callee itcan be provided that both the time of the receipt and/or the time of theend of the calls can be recorded. In so doing, the precise times of thereceipt and the end of a call can be defined dependent on the system. Inthe case in which the SIP protocol is used, the receipt of a call can bedefined, for example, as that time at which the INVITE message, i.e.,the message initiating the call, reaches the system with which the SPITidentification is carried out. In a similar manner the end of a call canbe defined as that time at which, in the case of the SIP protocol, a BYEmessage, i.e., one of the messages ending a call, is acquired by thesystem with which the SPIT identification is carried out.

With regard to a high scalability it can be provided that the recordedtimes, of the receipt and/or the end of a call, are stored in a softstate. Accordingly, the information thus stored is deleted after it hasbeen used to update the history of undesired calls, as will be explainedin detail further below.

In the framework of the development of the statistical profile of thetemporal structure of the undesired calls, i.e., in the framework of theinitial development in the learning phase as well as in the framework ofthe constant updating in the following operating phase, it can beprovided that the time of the receipt of an undesired call is related tothe times of the receipt and/or the end of the previous undesired calls.

In concrete terms, it can furthermore be provided that an average valueof the interval of time between the receipt of an undesired call and thereceipt and/or the end of the previous undesired call is calculated. Theaverage value thus calculated represents a suitable characteristicvariable to which the time of the receipt of a call to be investigatedcan be related in order to determine the probability that the call isundesired. The average values are also stored in a soft state and, as isdescribed in detail further below, constantly updated.

For the calculation of the probability that a call is a SPIT call, inthe operating phase it is advantageously calculated the interval of timebetween the receipt of a call to be investigated and the receipt and/orthe end of the previous undesired call. The thus calculated interval oftime can then be compared to the calculated and stored average value ofthe interval of time of the previous undesired calls, where on the basisof the comparison the probability that the call is an undesired call canbe determined.

With regard to high flexibility, which the adaptation to a changedbehavior of SPITers demands, a constant updating of the average valuecan be carried out. In a preferred manner the average value is alwaysupdated when an investigated call has been identified as an undesiredcall by the interval of time measured or calculated for the call beingcalculated in the currently stored average value of the interval of timeof the calls previous in time.

With regard to a high degree of reliability it can be provided that foreach incoming call a resulting probability that it is an undesired callis computed, where the resulting probability is determined from acombination of the calculated probability and external information. Theexternal information can, for example, be results obtained by means ofother processes and/or feedback on the part of the callee.

If the probability calculated for an incoming telephone call and/or theresulting probability exceeds a predefinable threshold, it can beprovided that the telephone call is not switched through to the callee.Advantageously, the threshold is a freely configurable parameter whichcan be defined according to the respective environment and theindividual desires of the user. Thus, the threshold can be chosen to behigh if the callee wishes to avoid a disturbance due to undesired callsunder any circumstances. A low threshold presents itself in case thecallee under no circumstances wishes to miss calls which are not SPITcalls.

With regard to as effective a functionality as possible it can beprovided that the tests are carried out at a point of the network whichas many calls as possible, in the ideal case all the calls, must pass.Accordingly, an implementation, e.g., in a session border control (SBC)in a proxy server or in a gatekeeper which serves a large number ofusers, has proven itself particularly advantageous.

There are various possibilities of developing and extending the teachingof the present invention in an advantageous manner. For this, referenceis made, on the one hand, to the claims subordinate to claim 1 and, onthe other hand, to the following explanation of a preferred embodimentexample of the invention with the aid of the drawing. In connection withthe explanation of the preferred embodiment example of the inventionwith the aid of the drawing, developments and extensions of the teachingwhich are preferred in general are also explained. In the drawings

FIG. 1 shows an embodiment example of the method according to theinvention for identifying undesired telephone calls and

FIG. 2 shows an example of a statistical profile of the temporalstructure of undesired calls.

FIG. 1 shows, schematically, an embodiment example of the methodaccording to the invention for identifying undesired calls, where thecalls coming in for a callee are subjected to a test. In FIG. 1 thearrival of a call i at time s_(i) is represented. The time s_(i) of thereceipt of the call is stored by the system. Then it is determined howso or a parameter derivable therefrom, behaves with respect to thetemporal distribution of previous SPIT calls which was determined inadvance and stored by the system. On the basis of this relationship aprobability L_(i) that call i is an undesired call is determined.

To update the history of the SPIT calls in the embodiment examplerepresented, information from additional SPIT identification methods aswell as feedback from called parties, be it implicitly throughtermination of the call or explicitly via a pushbutton which can beactuated by the callee, is taken into account.

Although not explicitly represented in FIG. 1, the calculatedprobability L_(i) can be combined with probabilities which have beendetermined in the framework of other SPIT identification methods inorder to compute a resulting probability and in this way to obtain amore precise evaluation. Depending on the requirements, the calculatedprobability or the resulting probability can be compared with athreshold on the overshoot of which the call is identified by the systemas SPIT and in given cases blocked, i.e., not switched through to thecallee. If the threshold is not exceeded, the call is considered aslegitimate and switched through to the callee. The threshold can be afreely configurable parameter of the system. If the threshold isexceeded, the call is used in addition to update the SPIT history.

FIG. 2 shows, also schematically, an example of a possible temporaldistribution of SPIT calls, where a “short-term behavior” (within onebundle of calls) as well as the “long-term behavior” (the temporaldistribution of the bundles themselves) are indicated. For reasons ofcomprehensibility, a case is represented in which the calls do notoverlap and in which all the SPIT calls come from a single caller. InFIG. 2 s_(i) denotes the time at which the i-th call is received andt_(i) the time at which the i-th call is ended.

For the identification of undesired calls in the scope of the short-termbehavior it is investigated how the intervals of time of the type(s_(i+1)−t_(i)) within the n-th bundle are distributed statistically.When the (i+1)-th call comes in, the probability L_(i+1) that this callis a SPIT call is calculated by it being investigated how the intervalof time (s_(i+1)−t_(i)) fits into the stored temporal distribution ofprevious SPIT calls.

In addition, the distribution of call bundles can be considered in theframework of an investigation of the long-term behavior. According tothe situation represented in FIG. 2, for example, the arrival times ofthe first SPIT call in each bundle (that is, s_(i) und s_(j) in theexample represented) can be drawn upon for a comparison. This type ofanalysis of the long-term behavior could, for example, help to track thebundle of calls which come in periodically or always at a certain timeof day.

In the following the calculation of the probability that a call isundesired will be explained in detail for the short-term behavior. Atthe time s_(j) a new call begins, call i. Thereupon, the interval oftime δ_(i) between the time t_(i+1) of the end of the previous call i−1and the time s_(i) is calculated. Let the average value m lastcalculated and stored in the system for the intervals of times betweenprevious undesired calls be denoted by m_(i−1). Let the half of thecorresponding confidence interval reflecting the variance be denoted byε_(i−1). In a next step it is checked whether δ₁εm_(i−1)±ε_(i−1) holds.In case this condition does hold, the probability Li that it is anundesired call is assigned a high value A. If δ_(i)<m_(i−1)−ε_(i−1), thecall moves outside of the “critical range” and the correspondingprobability L_(i) that it is an undesired call is assigned the value 0,i.e., it is a legitimate call.

A peculiarity is to be observed in the case δ_(i)>m_(i−1)+ε_(i−1). Inthis case the call does in fact also move outside of the critical rangebut there is the possibility that a SPIT call immediately preceding thecall to be investigated was missed, either because it was not detectedor because it had passed the observation point. This case can be takeninto account by it being checked whether the call falls in a laterinterval. However, the greater the interval of time between the callcurrently to be investigated and the last observed SPIT call is, thelower is the assigned probability that it is an undesired call. Thedescribed case can be taken into account mathematically, e g,, asfollows. n=δ_(i)/m_(i−1) is calculated and it is checked whether thefollowing holds:

δ_(i)εround(n) (m_(i−1)±ε_(i−1)).

If this is the case, then the probability L_(i) that call i is anundesired call is assigned the value L_(i)=A/round(n).

Let it be noted at this point that, if calls for the callee fromdifferent SPITers come in simultaneously, the average value m_(i−1) inpractice can be a vector of average values. This implies that δ_(i) mustbe checked against each individual average value. The complexityaccordingly grows linearly with the number of active SPITers, where,however, in practice it will be assumed that their number, at least withregard to an investigation of the short-term behavior, is quite limited.

Finally, the process of updating the average interval of time m and thecorresponding confidence interval ε_(i) which specifies a measure forhow the individual values are distributed about the average value, isstill to be explained in connection with FIG. 2. Two important points ofview must be taken into account in updating the average value, namely,first, that there can be SPIT calls which were not discovered by thesystem and, second, that different SPITers can operate in overlappinginterval of times, which means that potentially overlapping trends mustbe recognized and isolated.

In a concrete form of embodiment the average interval of time m isalways updated when a SPIT call has been recognized, be it that thesystem has identified the call as an undesired call and blocked it, orbe it that the call has passed the system but there is a negativefeedback on the part of the callee. For each incoming call the intervalof time δ_(i) is stored. The index i is increased by the value 1 eachtime that the average value is updated.

At the time i let m_(i−1) be the average interval of time lastcalculated and ε_(i−1) the half confidence interval. In the case thatδ_(i)εm_(i−1)±ε_(i−1) holds, the average value is updated together withits confidence interval simply by computing the new arithmetic averagevalue.

In the case that δ_(i) does not lie in the interval(δ_(i)∉m_(i−1)±ε_(i−1)) and that δ_(i)>m_(i−1), the valuen=δ_(i)/m_(i−1) is calculated in turn and it is checked whether:

δ_(i)∉round(n) (m_(i−1)±ε_(i−1)).

If this condition is met, then one proceeds from the assumption that thevalue does not fit into the previously prevailing pattern and thedevelopment of a new statistical profile (for another SPITer) is begun.Accordingly, a new average value μ with μ=δ_(i) is evaluated.

In the case that δ_(i) does not lie in the interval(δ_(i)∉m_(i−1)±ε_(i−1)) and that δ_(i)<m_(i−1), the valuen=δ_(i)/m_(i−1) is calculated in turn and it is checked whether:

δ_(i)∉(m_(i−1)±ε_(i−1))/round(n).

If this condition is met, then one proceeds from the assumption that thevalue does not fit into the previously prevailing time pattern and thedevelopment of a new statistical profile (for another SPITer) is begun.Accordingly, a new average value μ with μ=δ_(i) is evaluated.

If, on the contrary,

δ_(i)ε(m_(i−1)±ε_(i−1))/round(n),

then the updating of the average value m is computed according tom_(i+1)=δ_(i).

For reasons of scalability, the average value is stored in a soft stateand removed once again after a predefinable timeout. Storage andsubsequent removal of the average value can be carried out in thefollowing manner: the time t_(i), as that time at which the last SPITcall was ended, corresponds to the time at which the last update of theaverage value occurred, i.e., the corresponding stored value is m_(i).If up to the time t_(i)+x*m, no further updating occurs, the averagevalue is removed from storage. Here, x is a completely freelyconfigurable parameter. The described procedure is based on the ideathat it is improbable to miss more than x calls, on account of which itis appropriate to declare the bundle of calls after a time t_(i)+x*m_(i)as ended.

Let it be pointed out once again that all the operations involved in thealgorithm above are only carried out when a call is ended and isidentified by the system as SPIT. All the operations can be carried outin a simple manner without the performance of the system being impaired.The only variables which have to remain stored for each active SPITerare, one, the time at which the last call of the SPITer was ended, two,the last updated average value together with the correspondingconfidence interval, and, three, the number of SPIT calls which havebeen identified up till then as from the SPITer.

With regard to additional advantageous developments of the methodaccording to the invention, reference is made to the general part of thedescription as well as to the accompanying claims, in order to avoidrepetitions.

Finally, let it be expressly pointed out that the above-describedembodiment example merely serves to explain the claimed teaching butdoes not restrict it to the embodiment example.

1. Method for identifying undesired telephone calls, preferably in aVOIP network, in which the telephone calls coming in for a telephonesubscriber, the callee, from at least one calling telephone subscriber,the caller, are subjected to a test, characterized in that in theframework of the test for incoming calls, the time of the receipt ofeach call is determined and in each case the probability that it is anundesired call is determined, where for the calculation of theprobability the time of the receipt of the call, or a parameterdependent thereon, is related to the temporal distribution of previousundesired calls.
 2. Method according to claim 1, characterized in thatthe tests are carried out in an operating phase, where a learning phaseprecedes the operating phase in time and in said learning phase astatistical profile of the temporal structure of undesired calls over apredefinable period of time is developed.
 3. Method according to claim2, characterized in that undesired calls are identified in the learningphase with the aid of predefinable parameters.
 4. Method according toclaim 2, characterized in that undesired calls are identified in thelearning phase with the aid of feedback on the part of the callee. 5.Method according to claim 2, characterized in that undesired calls areidentified in the learning phase by means of other processes for therecognition of undesired calls.
 6. Method according to claim 2,characterized in that statistical profile of the temporal structure ofundesired calls is constantly updated in the operating phase.
 7. Methodaccording to claim 2, characterized in that, in the framework of thedevelopment of the statistical profile of the temporal structure of theundesired calls, the time of the receipt and/or the time of the end ofthe calls are recorded.
 8. Method according to claim 7, characterized inthat the times of the receipt and/or the times of the end of the callsare stored in a soft state.
 9. Method according to claim 7,characterized in that, in the framework of the development of thestatistical profile of the temporal structure of the undesired calls,the time of the receipt of an undesired call is related to the times ofthe receipt and/or the times of the end of the previous undesired calls.10. Method according to claim 9, characterized in that, in the frameworkof the development of the statistical profile of the temporal structureof the undesired calls, an average value of the interval of time betweenthe receipt of an undesired call and the receipt and/or the end of theprevious undesired call is calculated.
 11. Method according to claim 7,characterized in that in the operating phase the interval of timebetween the receipt of a call to be investigated and the receipt and/orthe end of the previous undesired call is calculated.
 12. Methodaccording to claim 11, characterized in that, for the determination ofthe probability that a call is undesired, the calculated interval oftime is compared to the calculated average value.
 13. Method accordingto claim 10, characterized in that the calculated average value isalways updated when in the operating phase a call has been identified asundesired.
 14. Method according to claim 1, characterized in that aresulting probability that a call is undesired is computed by thecalculated probability being combined with results obtained by means ofother processes and/or with feedback on the part of the callee. 15.Method according to claim 1, characterized in that a call is notswitched through to the callee if the probability calculated for thecall and/or the resulting probability exceed a threshold.
 16. Methodaccording to claim 15, characterized in that the threshold is freelyconfigurable.
 17. Method according to claim 1, characterized in that thetests are carried out at a point of the network which, at least in tothe greatest extent possible, all the calls must pass, preferably at asession border control (SBC) or a proxy server.
 18. Method according toclaim 3, characterized in that undesired calls are identified in thelearning phase with the aid of feedback on the part of the callee. 19.Method according to claim 8, characterized in that, in the framework ofthe development of the statistical profile of the temporal structure ofthe undesired calls, the time of the receipt of an undesired call isrelated to the times of the receipt and/or the times of the end of theprevious undesired calls.